New Nostr Scrutiny fact sheet: White Noise. https://scrutiny.hivescope.xyz/white-noise.html
Some facts that stood out:
- Group chats use Marmot (MLS over Nostr), with throwaway keys for each message. No audit yet: the protocol's own threat model marks 80 of 86 risk scenarios as unverified.
- Analytics, telemetry and diagnostic logs are off by default, on their own servers, with deletion deadlines.
- Firebase for push on Android, in the Zapstore build too.
- The app can share your location and Google Play lists location data, but the privacy policy never mentions it. The map loads straight from OpenStreetMap.
Some facts that stood out:
- Group chats use Marmot (MLS over Nostr), with throwaway keys for each message. No audit yet: the protocol's own threat model marks 80 of 86 risk scenarios as unverified.
- Analytics, telemetry and diagnostic logs are off by default, on their own servers, with deletion deadlines.
- Firebase for push on Android, in the Zapstore build too.
- The app can share your location and Google Play lists location data, but the privacy policy never mentions it. The map loads straight from OpenStreetMap.
11❤️2
